This is the Trace Id: 0eac1035e1058ec7c46be39d521b7a02
Skip to main content
Microsoft Security
Two colleagues collaborating at a computer, one pointing at the screen while the other types at a desk.

What is login security?

Login security prevents unauthorized access to online accounts. Strong login security protocols can protect people and businesses from cyberthreats.
Get started

Login security defined

Login security ensures that only genuine, authorized users can access online accounts, keeping bad actors out. Hacking into the billions of user accounts online is a lucrative enterprise for criminals. At one time, the only way to protect sensitive personal, financial, and business information in online accounts was a username and password combination. But login security best practices have evolved in step with the schemes of cybercriminals—who are always finding new ways to crack passwords.

Modern login security tools go beyond simple login and password combinations. Using an authentication method such as multifactor authentication (MFA) helps to verify the identities of genuine users with a greater degree of certainty while thwarting the attempts of bad actors.

Why is login security important?

  • Login security best practices are designed to shield individuals and businesses from financial loss and identity theft. Personal online digital profiles are treasure troves of identifying information, health data, and financial account numbers that hackers can either use or sell on the dark web.
  • For businesses, the ramifications of having a relaxed approach to login security are even more dire. Businesses face the additional threats of large-scale financial loss, theft of intellectual property, operational disruption, legal trouble, or a permanently damaged reputation in the eyes of customers.
  • Because more sophisticated login security greatly reduces all these risks, they are well worth the time and resources to implement. Without these extra layers of protection, businesses are easy targets for hackers—making inaction an expensive option in the long run.

Login security threats and vulnerabilities

To create a user identity and access strategy—especially in an era when secure remote work is a top concern—it’s important to understand tactics the cybercriminals use to steal passwords. Here are some key threats to be aware of:

Weak passwords

It’s human nature to want passwords to be easy to remember. But employing common words, phrases, or number combinations as passwords make users easy prey for thieves, who leverage automation to hack accounts quickly. Passwords made from words in the dictionary can be rooted out in seconds.

Brute-force attacks

Brute-force attackers use trial and error—sped up by automation—to gain unauthorized access to accounts. It’s a simple, go-to hacking method for stealing login credentials, encryption keys, and passwords.

Social engineering attacks

Social engineering attackers use false information to trick users into giving up their login information willingly. Phishing scams, for example, are emails that appear to be from reputable companies urging users to link to a fake site to log in, capturing the user’s login security credentials as they do. Baiting scams are similar, wheedling login information out of users by offering something for free.

Malware

Malware is short for malicious software, such as viruses, spyware, and ransomware. Hackers invade users’ devices with malware to harvest sensitive data. Malware can also be designed to damage networks and systems.

Spyware

Spyware is a type of malicious software that secretly records information such as login credentials and browser activity and copies it so it can be used for identity theft—or sold to a third party.

User enumeration

User enumeration, also known as directory harvesting, is when hackers use brute-force techniques to test whether a username is valid. Hackers flood login pages with common words, names of real people, or dictionary words and zero in on combinations that don’t return a result of “username not valid.” When hackers find a real username, they can get to work on hacking the password.

Types of login security and authentication methods

It’s important for businesses to stay one step ahead of attackers to ensure only genuine users gain access to their systems. Here are some types of advanced login security measures businesses can use to strengthen their defenses.

Multifactor authentication (MFA)

Login security is much stronger when users are asked for another piece of information to verify their identity. Multifactor authentication (MFA) or two-factor authentication (2FA) requires users to provide more than one additional piece of information to verify their identity. MFA asks users for verification with a combination of something they know, something they have, and something they are. A user might know a password or PIN, have a smartphone or secure USB key that is unique to them.

Increasingly, users have the option of using devices and apps that facilitate identity verification through biometric gestures. Facial recognition, voice recognition, and fingerprint scanning capabilities allow users to leverage their biologically unique traits to access accounts securely and conveniently.

Single sign-on (SSO)

Single sign-on allows users to access all their apps on a single platform with just one set of login credentials—rather than logging into them one by one. Not only is it faster, but it also helps reduce the risk of breaches by minimizing password reuse.

Passwordless authentication

What is the login security of the future going to look like? Passwordless. Passwordless authentication sets a new standard for identity and access management, providing the certainty of 2FA or MFA but with greater user convenience. Login credentials aren’t fixed in a passwordless platform, so hackers can’t steal them. Instead, users quickly authenticate their identity with something they have, such as a security key or an authenticator app on a phone, or a biometric scan.

Login security best practices

The stronger your password protection policy is, the better it will defend your business against criminal activity. There are many ways to fortify your organization’s login security, even if you have thousands of employee and customer accounts.

Limit login attempts

Brute-force attackers flourish when they can have uninterrupted access to a login page. Locking out accounts after a set number of login attempts foils tactics such as:
 
  • Credential stuffing—using lists of credentials found in data breaches and trying them on other websites.
  • Password spraying—attempting to use common passwords to hack into multiple accounts.
  • Dictionary attacks—using automation to rapidly apply whole dictionaries full of words as potential passwords.

Require more than one authentication factor

Adding extra layers of identity management through multifactor authentication doesn’t just double or triple your chances of staving off a cyberattack. It reduces your risk substantially. With cyberattack losses reaching into the trillions of dollars every year, MFA is becoming an increasing cost-effective choice for businesses.

Consider passwordless authentication

Hackers like passwords because they are easy to guess. So why not bypass them altogether? In a passwordless authentication scenario, a person logging in uses a combination of biometric factors, authentication apps, or tools such as USB tokens or badges to ascertain identity with an extremely high degree of certainty.

Login security solutions

When it comes to identity and access management, a little sophistication pays off. Each additional layer of authentication that you add to the login process dramatically reduces your risk of breaches. It also ensures that genuine users always have a safe path to get access to their accounts.

Adding complexity to your login security best practices doesn’t necessarily have to mean a time-consuming or frustrating experience for users. Microsoft enables businesses to move beyond basic authentication with seamless, secure password protection tools. These tools defend businesses by enforcing strong password policies, detecting and blocking weak passwords, and empowering users with self-serve password reset capabilities.
Learn more about password security
Resources

Learn more about Microsoft Security

  1.
Person working on laptop in a modern office seating area

Go passwordless

Forget passwords. Sign in with one look or tap.
Learn more
Man using desktop computer

Stop identity compromise

Keep your business protected with a seamless security solution.
Learn more
Two people looking at a laptop together

Understand phishing

Educate employees about common phishing tactics.
Learn more
Person using mobile phone to authenticate their work machine

Safeguard accounts with MFA

Learn how multifactor authentication (MFA) provides more secure account access.
Learn more
Man using phone to authenticate his laptop

Explore single sign-on

Learn how single sign-on (SSO) simplifies access to all your apps.
Learn more
Back to Related products section
FAQ

Frequently asked questions

  • A secure login is an account access process that uses more than one method to verify a user’s identity. Authenticating user identity with a higher degree of certainty reduces the risk of identity theft.
  • Protect your login information by creating strong passwords, using passwordless technologies when possible, and using multifactor and biometric authentication methods.
  • Strong passwords avoid easily guessed, common words and numerical patterns. Hackers have a harder time discovering passwords that use complex combinations of uppercase and lowercase letters and special characters. Try not to use the same passwords for multiple accounts.
  • An authentication method is a request an app or system makes to the user to verify their identity. This may be a passwordless technology or an extra verification step after the user inputs a password.
  • Your password is meant to keep your sensitive personal and business information from criminals who intend to use it for nefarious purposes. Identity theft and business losses due to cyberattacks can be prevented with enhanced password security.

Follow Microsoft Security